Caught · CriticalC2 / beaconing
A quiet workstation was beaconing to St Kitts every two minutes.
A host behind an edge firewall made a near-perfect 120-second outbound connection to a freshly-allocated Caribbean IP, the classic heartbeat of command-and-control. The firewall allowed it. ThisFirewall resolved the owner, correlated four signals into one timeline, and raised a single critical story instead of four orphan alerts.
ioc_matchdst on GreenSnow threat feed
c2_beaconing120s ± 5s, 99% regularity
enrichowner = new St Kitts ASN
correlate4 signals → 1 story, score 95
Action Block the /21 outbound + put EDR on the host. One click to the ticket.
Correctly ignoredC2 / beaconing
An identical beacon that turned out to be a video game.
A phone on the guest VLAN beaconed to a single IP every 120 seconds: the same shape as the St Kitts C2. But ThisFirewall resolved the destination to Jagex Ltd, the makers of RuneScape, and recognised gaming infrastructure. It auto-downgraded the alert to low instead of paging anyone.
c2_beaconing120s interval, 99% regularity
ip-identityowner = JAGEX-AS (gaming)
gate 4devery target = gaming → downgrade
verdictbenign · auto-low · audited
Outcome No page, no ticket and no analyst time. The signal stays on record at low priority.
Correctly ignoredData exfiltration
A "critical data exfiltration" that was just staff using a GenAI assistant.
Dozens of workstations were uploading hundreds of megabytes to a single external address, the textbook shape of exfiltration, and exactly what a volume rule pages on. But the firewall's own app-control had already named the destination: GenAI. ThisFirewall recognised staff pasting context into an AI assistant, auto-filed it as shadow-AI on the Shadow IT view, and never raised a critical alert.
data_exfilhigh upload, single destination
app-controlappcat = GenAI (AI assistant)
scrutinyfirewall-classified AI → benign
verdictshadow-AI · auto-suppressed · audited
Outcome No false critical to chase. The usage stays visible on the Shadow IT page for acceptable-use review, and a genuine upload to a non-AI destination still raises an alert.
Caught · HighRecon / scanning
A German bulletproof host was hammering the VPN portals.
A /24 on a known bulletproof-hosting ASN opened 11,000+ connections to the SSL-VPN portals on two firewalls. Every connection was reset, and there were zero successful logins in 30 days. ThisFirewall flagged the IoC match and the scan pattern, and confirmed no auth ever succeeded, so it surfaced the right action: block, don't panic.
ioc_matchSpamhaus DROP /24
scan11k conns → SSL-VPN :10443
auth check0 tunnels / 0 logins, 30d
enrichowner = DE bulletproof ASN
Action Block the DROP ranges inbound; geo-restrict SSL-VPN. Threat-feed connector makes it permanent.
Correctly ignoredAccount takeover
A "credential-stuffing takeover" that was just one user, two offices.
66 failed VPN logins from the Netherlands plus a successful login looked like a textbook account takeover until ThisFirewall noticed the fails and the success were on different firewalls. The foreign spray hit office A; the real user logged in normally at office B. No overlap, no compromise.
sslvpn_brute66 NL fails + 1 success
correlatefails ∩ success devices = 0
ruleATO needs device overlap
verdictde-escalated critical → medium
Outcome No 3am call-out. The fix is permanent: the detector now requires that overlap before it raises an account-takeover alert.
Caught · CriticalExfiltration
A backup service started shipping data to a country it never had before.
ThisFirewall learns each application's normal destination countries. When a backup service suddenly pushed over a gigabyte to a destination it had never used in 30 days, the drift, weighted by volume and the destination's reputation, escalated immediately. The traffic itself looked normal; the destination did not.
baselineapp's normal = 3 countries
driftnew country + 1.2GB out
reputationdst ASN flagged
scoredrift × volume × rep → high
Action Investigate the host + service account; confirm whether the destination is sanctioned. Pivot to flows in one click.
Correctly ignoredUEBA / identity
The "riskiest user on the network" was a VPN interface.
User-behaviour analytics flagged an account with an 18-million-sample, multi-gigabyte baseline as a wild anomaly. It was not a person. It was dialup1, an IPsec dial-up interface the firewall reports as a pseudo-user. ThisFirewall's identity classifier recognised the non-human pattern and excluded it, keeping the user-risk board honest.
ueba18.5M samples, 3GB stddev
classifieriface pseudo-account
actionexcluded from user baselines
verdictnot a user · not a threat
Outcome The real users stay in focus. Interfaces, IP literals and machine accounts never masquerade as people.
Caught · CriticalVulnerability
A firewall running firmware that's being exploited in the wild.
ThisFirewall cross-references each device's running firmware against vendor advisories and the CISA Known-Exploited-Vulnerabilities catalog. When a device's exact version fell inside the affected range of an actively-exploited CVE, it escalated to critical. A product mention alone is only flagged "version unconfirmed"; critical needs the exact build to match.
firmwarerunning version captured
psirt × kevin affected range + KEV
matchversion_range = confirmed
verdictcritical · patch now
Action Prioritise this firmware upgrade above all others. It is a known, actively exploited vulnerability.
Caught · HighLateral movement
One internal host quietly knocking on 400 ports a minute.
Buried in the denied-traffic noise that most tools ignore, a single internal host was probing hundreds of ports across the network in under a minute, the signature of lateral reconnaissance after a foothold. ThisFirewall keeps internal denied spikes as signal (not perimeter noise) and surfaced it.
denied_spike412 ports / 60s, one src
directioninternal → internal
contextkept as signal, not gated
verdictlateral recon · investigate host
Action Isolate and inspect the source host. Internal port sweeps rarely have a benign explanation.
